@claude-flow/security 3.0.0-alpha.7 → 3.0.0-alpha.9

package/__tests__/input-validator.test.ts

@@ -1,382 +1,382 @@
-/**
- * Input Validator Tests
- *
- * Tests verify:
- * - Zod schema validation
- * - Input sanitization
- * - Authentication schemas
- * - Command and path schemas
- */
-
-import { describe, it, expect } from 'vitest';
-import {
-  InputValidator,
-  sanitizeString,
-  sanitizeHtml,
-  sanitizePath,
-  SafeStringSchema,
-  IdentifierSchema,
-  EmailSchema,
-  PasswordSchema,
-  UUIDSchema,
-  HttpsUrlSchema,
-  PortSchema,
-  UserRoleSchema,
-  PermissionSchema,
-  LoginRequestSchema,
-  CreateUserSchema,
-  TaskInputSchema,
-  CommandArgumentSchema,
-  PathSchema,
-  PATTERNS,
-  LIMITS,
-} from '../src/input-validator.js';
-
-describe('InputValidator', () => {
-  describe('SafeStringSchema', () => {
-    it('should accept safe strings', () => {
-      expect(() => SafeStringSchema.parse('hello world')).not.toThrow();
-    });
-
-    it('should reject empty strings', () => {
-      expect(() => SafeStringSchema.parse('')).toThrow();
-    });
-
-    it('should reject strings with shell metacharacters', () => {
-      const dangerous = [';', '&&', '||', '|', '`', '$()', '${}', '>', '<'];
-      for (const char of dangerous) {
-        expect(() => SafeStringSchema.parse(`hello${char}world`)).toThrow();
-      }
-    });
-  });
-
-  describe('IdentifierSchema', () => {
-    it('should accept valid identifiers', () => {
-      expect(() => IdentifierSchema.parse('validId')).not.toThrow();
-      expect(() => IdentifierSchema.parse('valid-id')).not.toThrow();
-      expect(() => IdentifierSchema.parse('valid_id')).not.toThrow();
-      expect(() => IdentifierSchema.parse('validId123')).not.toThrow();
-    });
-
-    it('should reject identifiers starting with number', () => {
-      expect(() => IdentifierSchema.parse('123invalid')).toThrow();
-    });
-
-    it('should reject identifiers with special characters', () => {
-      expect(() => IdentifierSchema.parse('invalid@id')).toThrow();
-      expect(() => IdentifierSchema.parse('invalid id')).toThrow();
-    });
-
-    it('should reject empty identifiers', () => {
-      expect(() => IdentifierSchema.parse('')).toThrow();
-    });
-  });
-
-  describe('EmailSchema', () => {
-    it('should accept valid emails', () => {
-      expect(() => EmailSchema.parse('user@example.com')).not.toThrow();
-      expect(() => EmailSchema.parse('user.name@example.co.uk')).not.toThrow();
-    });
-
-    it('should reject invalid emails', () => {
-      expect(() => EmailSchema.parse('notanemail')).toThrow();
-      expect(() => EmailSchema.parse('@nodomain.com')).toThrow();
-      expect(() => EmailSchema.parse('no@')).toThrow();
-    });
-
-    it('should lowercase emails', () => {
-      const result = EmailSchema.parse('USER@EXAMPLE.COM');
-      expect(result).toBe('user@example.com');
-    });
-
-    it('should reject too long emails', () => {
-      const longEmail = 'a'.repeat(300) + '@example.com';
-      expect(() => EmailSchema.parse(longEmail)).toThrow();
-    });
-  });
-
-  describe('PasswordSchema', () => {
-    it('should accept valid passwords', () => {
-      expect(() => PasswordSchema.parse('SecurePass123')).not.toThrow();
-    });
-
-    it('should reject short passwords', () => {
-      expect(() => PasswordSchema.parse('Short1')).toThrow();
-    });
-
-    it('should reject passwords without uppercase', () => {
-      expect(() => PasswordSchema.parse('lowercase123')).toThrow();
-    });
-
-    it('should reject passwords without lowercase', () => {
-      expect(() => PasswordSchema.parse('UPPERCASE123')).toThrow();
-    });
-
-    it('should reject passwords without digits', () => {
-      expect(() => PasswordSchema.parse('NoDigitsHere')).toThrow();
-    });
-  });
-
-  describe('UUIDSchema', () => {
-    it('should accept valid UUIDs', () => {
-      expect(() => UUIDSchema.parse('550e8400-e29b-41d4-a716-446655440000')).not.toThrow();
-    });
-
-    it('should reject invalid UUIDs', () => {
-      expect(() => UUIDSchema.parse('not-a-uuid')).toThrow();
-      expect(() => UUIDSchema.parse('550e8400-e29b-41d4-a716')).toThrow();
-    });
-  });
-
-  describe('HttpsUrlSchema', () => {
-    it('should accept HTTPS URLs', () => {
-      expect(() => HttpsUrlSchema.parse('https://example.com')).not.toThrow();
-      expect(() => HttpsUrlSchema.parse('https://example.com/path')).not.toThrow();
-    });
-
-    it('should reject HTTP URLs', () => {
-      expect(() => HttpsUrlSchema.parse('http://example.com')).toThrow();
-    });
-
-    it('should reject invalid URLs', () => {
-      expect(() => HttpsUrlSchema.parse('not-a-url')).toThrow();
-    });
-  });
-
-  describe('PortSchema', () => {
-    it('should accept valid ports', () => {
-      expect(() => PortSchema.parse(80)).not.toThrow();
-      expect(() => PortSchema.parse(443)).not.toThrow();
-      expect(() => PortSchema.parse(3000)).not.toThrow();
-      expect(() => PortSchema.parse(65535)).not.toThrow();
-    });
-
-    it('should reject invalid ports', () => {
-      expect(() => PortSchema.parse(0)).toThrow();
-      expect(() => PortSchema.parse(-1)).toThrow();
-      expect(() => PortSchema.parse(65536)).toThrow();
-      expect(() => PortSchema.parse(3.14)).toThrow();
-    });
-  });
-
-  describe('UserRoleSchema', () => {
-    it('should accept valid roles', () => {
-      expect(() => UserRoleSchema.parse('admin')).not.toThrow();
-      expect(() => UserRoleSchema.parse('operator')).not.toThrow();
-      expect(() => UserRoleSchema.parse('developer')).not.toThrow();
-      expect(() => UserRoleSchema.parse('viewer')).not.toThrow();
-      expect(() => UserRoleSchema.parse('service')).not.toThrow();
-    });
-
-    it('should reject invalid roles', () => {
-      expect(() => UserRoleSchema.parse('superuser')).toThrow();
-      expect(() => UserRoleSchema.parse('root')).toThrow();
-    });
-  });
-
-  describe('PermissionSchema', () => {
-    it('should accept valid permissions', () => {
-      expect(() => PermissionSchema.parse('swarm.create')).not.toThrow();
-      expect(() => PermissionSchema.parse('agent.spawn')).not.toThrow();
-      expect(() => PermissionSchema.parse('system.admin')).not.toThrow();
-    });
-
-    it('should reject invalid permissions', () => {
-      expect(() => PermissionSchema.parse('invalid.permission')).toThrow();
-    });
-  });
-
-  describe('LoginRequestSchema', () => {
-    it('should accept valid login request', () => {
-      expect(() => LoginRequestSchema.parse({
-        email: 'user@example.com',
-        password: 'password123',
-      })).not.toThrow();
-    });
-
-    it('should accept login with MFA code', () => {
-      expect(() => LoginRequestSchema.parse({
-        email: 'user@example.com',
-        password: 'password123',
-        mfaCode: '123456',
-      })).not.toThrow();
-    });
-
-    it('should reject invalid MFA code length', () => {
-      expect(() => LoginRequestSchema.parse({
-        email: 'user@example.com',
-        password: 'password123',
-        mfaCode: '12345', // 5 digits instead of 6
-      })).toThrow();
-    });
-  });
-
-  describe('CreateUserSchema', () => {
-    it('should accept valid user creation', () => {
-      expect(() => CreateUserSchema.parse({
-        email: 'user@example.com',
-        password: 'SecurePass123',
-        role: 'developer',
-      })).not.toThrow();
-    });
-
-    it('should require strong password', () => {
-      expect(() => CreateUserSchema.parse({
-        email: 'user@example.com',
-        password: 'weak',
-        role: 'developer',
-      })).toThrow();
-    });
-  });
-
-  describe('TaskInputSchema', () => {
-    it('should accept valid task input', () => {
-      expect(() => TaskInputSchema.parse({
-        taskId: '550e8400-e29b-41d4-a716-446655440000',
-        content: 'Implement new feature',
-        agentType: 'coder',
-      })).not.toThrow();
-    });
-
-    it('should reject task with shell characters in content', () => {
-      expect(() => TaskInputSchema.parse({
-        taskId: '550e8400-e29b-41d4-a716-446655440000',
-        content: 'Implement feature; rm -rf /',
-        agentType: 'coder',
-      })).toThrow();
-    });
-  });
-
-  describe('CommandArgumentSchema', () => {
-    it('should accept safe arguments', () => {
-      expect(() => CommandArgumentSchema.parse('--flag')).not.toThrow();
-      expect(() => CommandArgumentSchema.parse('value')).not.toThrow();
-      expect(() => CommandArgumentSchema.parse('path/to/file')).not.toThrow();
-    });
-
-    it('should reject arguments with null bytes', () => {
-      expect(() => CommandArgumentSchema.parse('arg\x00injected')).toThrow();
-    });
-
-    it('should reject arguments with shell metacharacters', () => {
-      expect(() => CommandArgumentSchema.parse('arg;injected')).toThrow();
-      expect(() => CommandArgumentSchema.parse('arg&&injected')).toThrow();
-      expect(() => CommandArgumentSchema.parse('arg|injected')).toThrow();
-    });
-  });
-
-  describe('PathSchema', () => {
-    it('should accept valid paths', () => {
-      expect(() => PathSchema.parse('/path/to/file.ts')).not.toThrow();
-      expect(() => PathSchema.parse('./relative/path')).not.toThrow();
-    });
-
-    it('should reject paths with traversal', () => {
-      expect(() => PathSchema.parse('/path/../etc/passwd')).toThrow();
-    });
-
-    it('should reject paths with null bytes', () => {
-      expect(() => PathSchema.parse('/path/file\x00.jpg')).toThrow();
-    });
-  });
-
-  describe('Sanitization Functions', () => {
-    describe('sanitizeString', () => {
-      it('should remove null bytes', () => {
-        expect(sanitizeString('hello\x00world')).toBe('helloworld');
-      });
-
-      it('should remove HTML brackets', () => {
-        expect(sanitizeString('<script>alert(1)</script>')).toBe('scriptalert(1)/script');
-      });
-
-      it('should remove javascript: protocol', () => {
-        expect(sanitizeString('javascript:alert(1)')).toBe('alert(1)');
-      });
-
-      it('should trim whitespace', () => {
-        expect(sanitizeString('  hello  ')).toBe('hello');
-      });
-    });
-
-    describe('sanitizeHtml', () => {
-      it('should escape HTML entities', () => {
-        expect(sanitizeHtml('<script>')).toBe('&lt;script&gt;');
-        expect(sanitizeHtml('"quoted"')).toBe('&quot;quoted&quot;');
-        expect(sanitizeHtml("'apostrophe'")).toBe('&#x27;apostrophe&#x27;');
-        expect(sanitizeHtml('a & b')).toBe('a &amp; b');
-      });
-    });
-
-    describe('sanitizePath', () => {
-      it('should remove null bytes', () => {
-        expect(sanitizePath('/path\x00/file')).toBe('path/file');
-      });
-
-      it('should remove traversal patterns', () => {
-        // '../etc/passwd' → remove '..' → '/etc/passwd' → remove leading '/' → 'etc/passwd'
-        expect(sanitizePath('../etc/passwd')).toBe('etc/passwd');
-      });
-
-      it('should normalize slashes', () => {
-        expect(sanitizePath('/path//to///file')).toBe('path/to/file');
-      });
-
-      it('should remove leading slash', () => {
-        expect(sanitizePath('/absolute/path')).toBe('absolute/path');
-      });
-    });
-  });
-
-  describe('InputValidator Class', () => {
-    it('should validate email', () => {
-      expect(InputValidator.validateEmail('user@example.com')).toBe('user@example.com');
-    });
-
-    it('should validate password', () => {
-      expect(() => InputValidator.validatePassword('SecurePass123')).not.toThrow();
-    });
-
-    it('should validate identifier', () => {
-      expect(InputValidator.validateIdentifier('myId')).toBe('myId');
-    });
-
-    it('should validate path', () => {
-      expect(InputValidator.validatePath('/valid/path')).toBe('/valid/path');
-    });
-
-    it('should validate command argument', () => {
-      expect(InputValidator.validateCommandArg('--flag')).toBe('--flag');
-    });
-
-    it('should validate login request', () => {
-      const result = InputValidator.validateLoginRequest({
-        email: 'USER@example.com',
-        password: 'password',
-      });
-      expect(result.email).toBe('user@example.com');
-    });
-
-    it('should safely parse with result', () => {
-      const success = InputValidator.safeParse(EmailSchema, 'user@example.com');
-      expect(success.success).toBe(true);
-
-      const failure = InputValidator.safeParse(EmailSchema, 'invalid');
-      expect(failure.success).toBe(false);
-    });
-  });
-
-  describe('Constants', () => {
-    it('should export PATTERNS', () => {
-      expect(PATTERNS.SAFE_IDENTIFIER).toBeDefined();
-      expect(PATTERNS.SAFE_FILENAME).toBeDefined();
-      expect(PATTERNS.NO_SHELL_CHARS).toBeDefined();
-    });
-
-    it('should export LIMITS', () => {
-      expect(LIMITS.MIN_PASSWORD_LENGTH).toBe(8);
-      expect(LIMITS.MAX_PASSWORD_LENGTH).toBe(128);
-      expect(LIMITS.MAX_PATH_LENGTH).toBe(4096);
-    });
-  });
-});
+/**
+ * Input Validator Tests
+ *
+ * Tests verify:
+ * - Zod schema validation
+ * - Input sanitization
+ * - Authentication schemas
+ * - Command and path schemas
+ */
+
+import { describe, it, expect } from 'vitest';
+import {
+  InputValidator,
+  sanitizeString,
+  sanitizeHtml,
+  sanitizePath,
+  SafeStringSchema,
+  IdentifierSchema,
+  EmailSchema,
+  PasswordSchema,
+  UUIDSchema,
+  HttpsUrlSchema,
+  PortSchema,
+  UserRoleSchema,
+  PermissionSchema,
+  LoginRequestSchema,
+  CreateUserSchema,
+  TaskInputSchema,
+  CommandArgumentSchema,
+  PathSchema,
+  PATTERNS,
+  LIMITS,
+} from '../src/input-validator.js';
+
+describe('InputValidator', () => {
+  describe('SafeStringSchema', () => {
+    it('should accept safe strings', () => {
+      expect(() => SafeStringSchema.parse('hello world')).not.toThrow();
+    });
+
+    it('should reject empty strings', () => {
+      expect(() => SafeStringSchema.parse('')).toThrow();
+    });
+
+    it('should reject strings with shell metacharacters', () => {
+      const dangerous = [';', '&&', '||', '|', '`', '$()', '${}', '>', '<'];
+      for (const char of dangerous) {
+        expect(() => SafeStringSchema.parse(`hello${char}world`)).toThrow();
+      }
+    });
+  });
+
+  describe('IdentifierSchema', () => {
+    it('should accept valid identifiers', () => {
+      expect(() => IdentifierSchema.parse('validId')).not.toThrow();
+      expect(() => IdentifierSchema.parse('valid-id')).not.toThrow();
+      expect(() => IdentifierSchema.parse('valid_id')).not.toThrow();
+      expect(() => IdentifierSchema.parse('validId123')).not.toThrow();
+    });
+
+    it('should reject identifiers starting with number', () => {
+      expect(() => IdentifierSchema.parse('123invalid')).toThrow();
+    });
+
+    it('should reject identifiers with special characters', () => {
+      expect(() => IdentifierSchema.parse('invalid@id')).toThrow();
+      expect(() => IdentifierSchema.parse('invalid id')).toThrow();
+    });
+
+    it('should reject empty identifiers', () => {
+      expect(() => IdentifierSchema.parse('')).toThrow();
+    });
+  });
+
+  describe('EmailSchema', () => {
+    it('should accept valid emails', () => {
+      expect(() => EmailSchema.parse('user@example.com')).not.toThrow();
+      expect(() => EmailSchema.parse('user.name@example.co.uk')).not.toThrow();
+    });
+
+    it('should reject invalid emails', () => {
+      expect(() => EmailSchema.parse('notanemail')).toThrow();
+      expect(() => EmailSchema.parse('@nodomain.com')).toThrow();
+      expect(() => EmailSchema.parse('no@')).toThrow();
+    });
+
+    it('should lowercase emails', () => {
+      const result = EmailSchema.parse('USER@EXAMPLE.COM');
+      expect(result).toBe('user@example.com');
+    });
+
+    it('should reject too long emails', () => {
+      const longEmail = 'a'.repeat(300) + '@example.com';
+      expect(() => EmailSchema.parse(longEmail)).toThrow();
+    });
+  });
+
+  describe('PasswordSchema', () => {
+    it('should accept valid passwords', () => {
+      expect(() => PasswordSchema.parse('SecurePass123')).not.toThrow();
+    });
+
+    it('should reject short passwords', () => {
+      expect(() => PasswordSchema.parse('Short1')).toThrow();
+    });
+
+    it('should reject passwords without uppercase', () => {
+      expect(() => PasswordSchema.parse('lowercase123')).toThrow();
+    });
+
+    it('should reject passwords without lowercase', () => {
+      expect(() => PasswordSchema.parse('UPPERCASE123')).toThrow();
+    });
+
+    it('should reject passwords without digits', () => {
+      expect(() => PasswordSchema.parse('NoDigitsHere')).toThrow();
+    });
+  });
+
+  describe('UUIDSchema', () => {
+    it('should accept valid UUIDs', () => {
+      expect(() => UUIDSchema.parse('550e8400-e29b-41d4-a716-446655440000')).not.toThrow();
+    });
+
+    it('should reject invalid UUIDs', () => {
+      expect(() => UUIDSchema.parse('not-a-uuid')).toThrow();
+      expect(() => UUIDSchema.parse('550e8400-e29b-41d4-a716')).toThrow();
+    });
+  });
+
+  describe('HttpsUrlSchema', () => {
+    it('should accept HTTPS URLs', () => {
+      expect(() => HttpsUrlSchema.parse('https://example.com')).not.toThrow();
+      expect(() => HttpsUrlSchema.parse('https://example.com/path')).not.toThrow();
+    });
+
+    it('should reject HTTP URLs', () => {
+      expect(() => HttpsUrlSchema.parse('http://example.com')).toThrow();
+    });
+
+    it('should reject invalid URLs', () => {
+      expect(() => HttpsUrlSchema.parse('not-a-url')).toThrow();
+    });
+  });
+
+  describe('PortSchema', () => {
+    it('should accept valid ports', () => {
+      expect(() => PortSchema.parse(80)).not.toThrow();
+      expect(() => PortSchema.parse(443)).not.toThrow();
+      expect(() => PortSchema.parse(3000)).not.toThrow();
+      expect(() => PortSchema.parse(65535)).not.toThrow();
+    });
+
+    it('should reject invalid ports', () => {
+      expect(() => PortSchema.parse(0)).toThrow();
+      expect(() => PortSchema.parse(-1)).toThrow();
+      expect(() => PortSchema.parse(65536)).toThrow();
+      expect(() => PortSchema.parse(3.14)).toThrow();
+    });
+  });
+
+  describe('UserRoleSchema', () => {
+    it('should accept valid roles', () => {
+      expect(() => UserRoleSchema.parse('admin')).not.toThrow();
+      expect(() => UserRoleSchema.parse('operator')).not.toThrow();
+      expect(() => UserRoleSchema.parse('developer')).not.toThrow();
+      expect(() => UserRoleSchema.parse('viewer')).not.toThrow();
+      expect(() => UserRoleSchema.parse('service')).not.toThrow();
+    });
+
+    it('should reject invalid roles', () => {
+      expect(() => UserRoleSchema.parse('superuser')).toThrow();
+      expect(() => UserRoleSchema.parse('root')).toThrow();
+    });
+  });
+
+  describe('PermissionSchema', () => {
+    it('should accept valid permissions', () => {
+      expect(() => PermissionSchema.parse('swarm.create')).not.toThrow();
+      expect(() => PermissionSchema.parse('agent.spawn')).not.toThrow();
+      expect(() => PermissionSchema.parse('system.admin')).not.toThrow();
+    });
+
+    it('should reject invalid permissions', () => {
+      expect(() => PermissionSchema.parse('invalid.permission')).toThrow();
+    });
+  });
+
+  describe('LoginRequestSchema', () => {
+    it('should accept valid login request', () => {
+      expect(() => LoginRequestSchema.parse({
+        email: 'user@example.com',
+        password: 'password123',
+      })).not.toThrow();
+    });
+
+    it('should accept login with MFA code', () => {
+      expect(() => LoginRequestSchema.parse({
+        email: 'user@example.com',
+        password: 'password123',
+        mfaCode: '123456',
+      })).not.toThrow();
+    });
+
+    it('should reject invalid MFA code length', () => {
+      expect(() => LoginRequestSchema.parse({
+        email: 'user@example.com',
+        password: 'password123',
+        mfaCode: '12345', // 5 digits instead of 6
+      })).toThrow();
+    });
+  });
+
+  describe('CreateUserSchema', () => {
+    it('should accept valid user creation', () => {
+      expect(() => CreateUserSchema.parse({
+        email: 'user@example.com',
+        password: 'SecurePass123',
+        role: 'developer',
+      })).not.toThrow();
+    });
+
+    it('should require strong password', () => {
+      expect(() => CreateUserSchema.parse({
+        email: 'user@example.com',
+        password: 'weak',
+        role: 'developer',
+      })).toThrow();
+    });
+  });
+
+  describe('TaskInputSchema', () => {
+    it('should accept valid task input', () => {
+      expect(() => TaskInputSchema.parse({
+        taskId: '550e8400-e29b-41d4-a716-446655440000',
+        content: 'Implement new feature',
+        agentType: 'coder',
+      })).not.toThrow();
+    });
+
+    it('should reject task with shell characters in content', () => {
+      expect(() => TaskInputSchema.parse({
+        taskId: '550e8400-e29b-41d4-a716-446655440000',
+        content: 'Implement feature; rm -rf /',
+        agentType: 'coder',
+      })).toThrow();
+    });
+  });
+
+  describe('CommandArgumentSchema', () => {
+    it('should accept safe arguments', () => {
+      expect(() => CommandArgumentSchema.parse('--flag')).not.toThrow();
+      expect(() => CommandArgumentSchema.parse('value')).not.toThrow();
+      expect(() => CommandArgumentSchema.parse('path/to/file')).not.toThrow();
+    });
+
+    it('should reject arguments with null bytes', () => {
+      expect(() => CommandArgumentSchema.parse('arg\x00injected')).toThrow();
+    });
+
+    it('should reject arguments with shell metacharacters', () => {
+      expect(() => CommandArgumentSchema.parse('arg;injected')).toThrow();
+      expect(() => CommandArgumentSchema.parse('arg&&injected')).toThrow();
+      expect(() => CommandArgumentSchema.parse('arg|injected')).toThrow();
+    });
+  });
+
+  describe('PathSchema', () => {
+    it('should accept valid paths', () => {
+      expect(() => PathSchema.parse('/path/to/file.ts')).not.toThrow();
+      expect(() => PathSchema.parse('./relative/path')).not.toThrow();
+    });
+
+    it('should reject paths with traversal', () => {
+      expect(() => PathSchema.parse('/path/../etc/passwd')).toThrow();
+    });
+
+    it('should reject paths with null bytes', () => {
+      expect(() => PathSchema.parse('/path/file\x00.jpg')).toThrow();
+    });
+  });
+
+  describe('Sanitization Functions', () => {
+    describe('sanitizeString', () => {
+      it('should remove null bytes', () => {
+        expect(sanitizeString('hello\x00world')).toBe('helloworld');
+      });
+
+      it('should remove HTML brackets', () => {
+        expect(sanitizeString('<script>alert(1)</script>')).toBe('scriptalert(1)/script');
+      });
+
+      it('should remove javascript: protocol', () => {
+        expect(sanitizeString('javascript:alert(1)')).toBe('alert(1)');
+      });
+
+      it('should trim whitespace', () => {
+        expect(sanitizeString('  hello  ')).toBe('hello');
+      });
+    });
+
+    describe('sanitizeHtml', () => {
+      it('should escape HTML entities', () => {
+        expect(sanitizeHtml('<script>')).toBe('&lt;script&gt;');
+        expect(sanitizeHtml('"quoted"')).toBe('&quot;quoted&quot;');
+        expect(sanitizeHtml("'apostrophe'")).toBe('&#x27;apostrophe&#x27;');
+        expect(sanitizeHtml('a & b')).toBe('a &amp; b');
+      });
+    });
+
+    describe('sanitizePath', () => {
+      it('should remove null bytes', () => {
+        expect(sanitizePath('/path\x00/file')).toBe('path/file');
+      });
+
+      it('should remove traversal patterns', () => {
+        // '../etc/passwd' → remove '..' → '/etc/passwd' → remove leading '/' → 'etc/passwd'
+        expect(sanitizePath('../etc/passwd')).toBe('etc/passwd');
+      });
+
+      it('should normalize slashes', () => {
+        expect(sanitizePath('/path//to///file')).toBe('path/to/file');
+      });
+
+      it('should remove leading slash', () => {
+        expect(sanitizePath('/absolute/path')).toBe('absolute/path');
+      });
+    });
+  });
+
+  describe('InputValidator Class', () => {
+    it('should validate email', () => {
+      expect(InputValidator.validateEmail('user@example.com')).toBe('user@example.com');
+    });
+
+    it('should validate password', () => {
+      expect(() => InputValidator.validatePassword('SecurePass123')).not.toThrow();
+    });
+
+    it('should validate identifier', () => {
+      expect(InputValidator.validateIdentifier('myId')).toBe('myId');
+    });
+
+    it('should validate path', () => {
+      expect(InputValidator.validatePath('/valid/path')).toBe('/valid/path');
+    });
+
+    it('should validate command argument', () => {
+      expect(InputValidator.validateCommandArg('--flag')).toBe('--flag');
+    });
+
+    it('should validate login request', () => {
+      const result = InputValidator.validateLoginRequest({
+        email: 'USER@example.com',
+        password: 'password',
+      });
+      expect(result.email).toBe('user@example.com');
+    });
+
+    it('should safely parse with result', () => {
+      const success = InputValidator.safeParse(EmailSchema, 'user@example.com');
+      expect(success.success).toBe(true);
+
+      const failure = InputValidator.safeParse(EmailSchema, 'invalid');
+      expect(failure.success).toBe(false);
+    });
+  });
+
+  describe('Constants', () => {
+    it('should export PATTERNS', () => {
+      expect(PATTERNS.SAFE_IDENTIFIER).toBeDefined();
+      expect(PATTERNS.SAFE_FILENAME).toBeDefined();
+      expect(PATTERNS.NO_SHELL_CHARS).toBeDefined();
+    });
+
+    it('should export LIMITS', () => {
+      expect(LIMITS.MIN_PASSWORD_LENGTH).toBe(8);
+      expect(LIMITS.MAX_PASSWORD_LENGTH).toBe(128);
+      expect(LIMITS.MAX_PATH_LENGTH).toBe(4096);
+    });
+  });
+});